feat: breadcrumbs, keyboard a11y, SECURITY.md, and ADRs

[Ndifreke000]

Summary

This PR resolves four issues in one branch:

• Closes feat: Add breadcrumb navigation for nested app pages #169 — Add breadcrumb navigation for nested app pages
• Closes a11y: Comprehensive keyboard navigation audit and focus management #172 — Comprehensive keyboard navigation audit and focus management
• Closes docs: Add SECURITY.md with responsible vulnerability disclosure policy #178 — Add SECURITY.md with responsible vulnerability disclosure policy
• Closes docs: Add architecture decision records (ADRs) for key design choices #179 — Add architecture decision records (ADRs) for key design choices

---

#169 — Breadcrumb navigation

• New components/layout/breadcrumb.tsx — 'use client' component that reads usePathname() and builds a crumb trail from the URL segments
• Uses <nav aria-label="Breadcrumb"> + <ol> for accessible markup
• Current page rendered as <span aria-current="page"> (not a link)
• Middle segments truncated on mobile with CSS max-w + truncate
• Handles dynamic routes (/app/stream/[id]) with a human-readable label fallback
• Inserted into app/app/layout.tsx between <Navbar /> and <main>

#172 — Keyboard navigation audit

• NetworkMismatchModal — fixed broken <a> tag (was missing <a), added focus trap (Tab cycles within modal), Escape closes + restores focus, auto-focuses dismiss button on mount, cleanup on unmount
• NotificationBell — added ref to trigger button, Escape key handler closes panel and restores focus to trigger, aria-expanded + aria-haspopup attributes, focus-visible:ring on all interactive elements inside the panel
• CommandPalette — rewritten with a reusable FocusTrap component (Tab/Shift+Tab cycles, Escape fires callback), autoFocus on the command input, focus restoration to the element that opened the palette, dark-mode classes, corrected internal routes to /app/*
• app/globals.css — added @layer base { :focus-visible { ... } } rule to enforce a visible ring on all focusable elements in both light and dark themes

#178 — SECURITY.md

• Created SECURITY.md at the repo root with: in-scope/out-of-scope definition, private reporting process (GitHub Security Advisories preferred), response timeline (acknowledgment 48h → fix 72h–2w by severity), severity classification table (Critical → Low), safe harbor statement, and note on bug bounty
• Added link from README.md

#179 — Architecture Decision Records

• Created docs/adr/ with README.md index and ADR-000-template.md
• 7 ADRs covering all high and medium priority decisions from the issue:
  • ADR-001: Persistent vs Instance Storage for Streams
  • ADR-002: Client-Side Unlock Calculation
  • ADR-003: Mock Mode for Development
  • ADR-004: Polling vs WebSocket for Updates
  • ADR-005: BigInt for Token Amounts
  • ADR-006: Freighter-Only Wallet Strategy
  • ADR-007: Integer Division Dust Handling
• Added ADR index link from README.md

🤖 Generated with Claude Code

[drips-wave]

@Ndifreke000 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits